CVE Vulnerability

CVE-2018-9063

MapDrv (C:Program FilesLenovoSystem Updatemapdrv.exe) In Lenovo System Update versions earlier than 5.07.0072 contains a local vulnerability where an attacker entering very large user ID or password can overrun the program's buffer, causing undefined behaviors, such as execution of arbitrary code. No additional privilege is granted to the attacker beyond what is already possessed to run MapDrv.

4.6 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 6.4

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

Scope

7.8 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://support.lenovo.com/us/en/solutions/LEN-19625 Vendor Advisory
http://www.securityfocus.com/bid/104125 Third Party Advisory VDB Entry
Configurations

Configuration 1

cpe:2.3:a:lenovo:system_update:*:*:*:*:*:*:*:*
Information

Published : 2018-05-04 05:29

Updated : 2018-06-13 03:18

NVD link : CVE-2018-9063

Mitre link : CVE-2018-9063

Products Affected

Lenovo

System Update

CWE
CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer